Smartwatches and fitness trackers can build a detailed picture of how our bodies are performing, but what may look like simple wellbeing data can raise more complex legal questions. For businesses, one of the key data protection issues is knowing when that information crosses the line and becomes protected health data.
The distinction between health and wellbeing data came up during our recent Glasgow Tech Week panel on wearable technology and personal data. Under UK data protection law, information concerning a person’s physical or mental health is classed as special category data and is subject to additional safeguards. “Wellbeing data”, however, is not a separate legal category with its own definition, so the way information is collected, combined and used can make a real difference to whether it falls within the concept of health data and how it should be treated.
Take something as simple as a step count. On its own, a step count may only show how active someone has been that day. But combined with resting heart rate, sleep patterns and changes in activity over a longer period, it could contribute to a much clearer picture of that person’s health and may allow conclusions to be drawn about their physical or mental condition. The issue is therefore not just the individual pieces of information a device collects, but what can be learned from them when they are brought together.
As wearable technology becomes more sophisticated, the combination of data points will become increasingly relevant. Many devices already go well beyond simply recording information for users to view themselves. They can identify trends, generate scores, flag changes and make recommendations based on the data they collect. As artificial intelligence becomes more widely used, the ability to spot patterns and draw conclusions from large amounts of information is only likely to increase.
For businesses developing or using wearable technology, it is important to look beyond whether a product is described as focusing on “fitness” or “wellbeing”. What matters is what the technology is actually doing with the information. If it is being used to identify, infer, assess or draw conclusions about a person’s physical or mental health, additional data protection requirements may apply.
It also raises an important issue around transparency. If a person shares their step count with a fitness app, they will most likely believe that the information is being used to track their exercise. They may be less likely to expect it to be combined with other information to assess health risks or build a more detailed picture of their wellbeing. Businesses, therefore, need to be clear about what they are collecting, how that information is being analysed and how it may ultimately be used to reveal about a person’s health.
None of this means that wearable technology should be treated with suspicion. It can give people useful information about their health and wellbeing and has the potential to support better monitoring and earlier intervention. But as devices become more capable, the legal position becomes less about the label attached to the data and more about what can be inferred from that data when it is analysed, combined with other information or used to generate insights.
The line between wellbeing data and health data will not always be obvious particularly where seemingly innocuous data points are combined to reveal information about a person's health. For organisations working in this space, understanding when that line has been crossed, or may have been crossed through the analysis and combination of different data points, will become increasingly important as the technology develops.
This article was originally published in the Scotsman - read the original article here.
